HTML parser: implementing throw-on-dynamic-markup-insertion counter

third_party/WebKit/Source/core/dom/Document.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
  *           (C) 2006 Alexey Proskuryakov (ap@webkit.org)
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2011, 2012 Apple Inc. All rights reserved.
  * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  * Copyright (C) 2008, 2009, 2011, 2012 Google Inc. All rights reserved.
  * Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies)
  * Copyright (C) Research In Motion Limited 2010-2011. All rights reserved.
@@ skipping 414 matching lines @@
     , m_mutationObserverTypes(0)
     , m_visitedLinkState(VisitedLinkState::create(*this))
     , m_visuallyOrdered(false)
     , m_readyState(Complete)
     , m_parsingState(FinishedParsing)
     , m_gotoAnchorNeededAfterStylesheetsLoad(false)
     , m_containsValidityStyleRules(false)
     , m_containsPlugins(false)
     , m_updateFocusAppearanceSelectionBahavior(SelectionBehaviorOnFocus::Reset)
     , m_ignoreDestructiveWriteCount(0)
+    , m_throwOnDynamicMarkupInsertionCount(0)
     , m_markers(new DocumentMarkerController(*this))
     , m_updateFocusAppearanceTimer(this, &Document::updateFocusAppearanceTimerFired)
     , m_cssTarget(nullptr)
     , m_loadEventProgress(LoadEventNotRun)
     , m_startTime(currentTime())
     , m_scriptRunner(ScriptRunner::create(this))
     , m_xmlVersion("1.0")
     , m_xmlStandalone(StandaloneUnspecified)
     , m_hasXMLDeclaration(0)
     , m_designMode(false)
@@ skipping 1818 matching lines @@
     // relationship. This ensures that we don't leave import loads in flight,
     // thinking they should have access to a valid frame when they don't.
     if (m_importsController) {
         m_importsController->dispose();
         setImportsController(nullptr);
     }
 
     m_timers.setTimerTaskRunner(
         Platform::current()->currentThread()->scheduler()->timerTaskRunner()->clone());
 
+    // This is required, as our LocalFrame might delete itself as soon as it detaches
+    // us. However, this violates Node::detachLayoutTree() semantics, as it's never
+    // possible to re-attach. Eventually Document::detachLayoutTree() should be renamed,
+    // or this setting of the frame to 0 could be made explicit in each of the
+    // callers of Document::detachLayoutTree().
+    m_frame = nullptr;
+
     if (m_mediaQueryMatcher)
         m_mediaQueryMatcher->documentDetached();
 
     m_lifecycle.advanceTo(DocumentLifecycle::Stopped);
 
     // FIXME: Currently we call notifyContextDestroyed() only in
     // Document::detachLayoutTree(), which means that we don't call
     // notifyContextDestroyed() for a document that doesn't get detached.
     // If such a document has any observer, the observer won't get
     // a contextDestroyed() notification. This can happen for a document
     // created by DOMImplementation::createDocument().
     ExecutionContext::notifyContextDestroyed();

[dominicc (has gone to gerrit), 2016/09/28 08:01:03]

Just curious--why did you move this?

-
-    // This is required, as our LocalFrame might delete itself as soon as it detaches
-    // us. However, this violates Node::detachLayoutTree() semantics, as it's never
-    // possible to re-attach. Eventually Document::detachLayoutTree() should be renamed,
-    // or this setting of the frame to 0 could be made explicit in each of the
-    // callers of Document::detachLayoutTree().
-    m_frame = nullptr;
 }
 
 void Document::removeAllEventListeners()
 {
     ContainerNode::removeAllEventListeners();
 
     if (LocalDOMWindow* domWindow = this->domWindow())
         domWindow->removeAllEventListeners();
 }
 
@@ skipping 84 matching lines @@
     if (importLoader()) {
         exceptionState.throwDOMException(InvalidStateError, "Imported document doesn't support open().");
         return;
     }
 
     if (!isHTMLDocument()) {
         exceptionState.throwDOMException(InvalidStateError, "Only HTML documents support open().");
         return;
     }
 
+    if (m_throwOnDynamicMarkupInsertionCount) {
+        exceptionState.throwDOMException(InvalidStateError, "Custom Element constructor should not use open().");
+        return;
+    }
+
     if (enteredDocument) {
         if (!getSecurityOrigin()->canAccess(enteredDocument->getSecurityOrigin())) {
             exceptionState.throwSecurityError("Can only call open() on same-origin documents.");
             return;
         }
         setSecurityOrigin(enteredDocument->getSecurityOrigin());
         setURL(enteredDocument->url());
         m_cookieURL = enteredDocument->cookieURL();
     }
 
@@ skipping 177 matching lines @@
     if (importLoader()) {
         exceptionState.throwDOMException(InvalidStateError, "Imported document doesn't support close().");
         return;
     }
 
     if (!isHTMLDocument()) {
         exceptionState.throwDOMException(InvalidStateError, "Only HTML documents support close().");
         return;
     }
 
+    if (m_throwOnDynamicMarkupInsertionCount) {
+        exceptionState.throwDOMException(InvalidStateError, "Custom Element constructor should not use close().");
+        return;
+    }
+
     close();
 }
 
 void Document::close()
 {
     if (!scriptableDocumentParser() || !scriptableDocumentParser()->wasCreatedByScript() || !scriptableDocumentParser()->isParsing())
         return;
 
     if (DocumentParser* parser = m_parser)
         parser->finish();
@@ skipping 243 matching lines @@
     if (importLoader()) {
         exceptionState.throwDOMException(InvalidStateError, "Imported document doesn't support write().");
         return;
     }
 
     if (!isHTMLDocument()) {
         exceptionState.throwDOMException(InvalidStateError, "Only HTML documents support write().");
         return;
     }
 
+    if (m_throwOnDynamicMarkupInsertionCount) {
+        exceptionState.throwDOMException(InvalidStateError, "Custom Element constructor should not use write().");
+        return;
+    }
+
     if (enteredDocument && !getSecurityOrigin()->canAccess(enteredDocument->getSecurityOrigin())) {
         exceptionState.throwSecurityError("Can only call write() on same-origin documents.");
         return;
     }
 
     NestingLevelIncrementer nestingLevelIncrementer(m_writeRecursionDepth);
 
     m_writeRecursionIsTooDeep = (m_writeRecursionDepth > 1) && m_writeRecursionIsTooDeep;
     m_writeRecursionIsTooDeep = (m_writeRecursionDepth > cMaxWriteRecursionDepth) || m_writeRecursionIsTooDeep;
 
@@ skipping 3219 matching lines @@
 }
 
 void showLiveDocumentInstances()
 {
     WeakDocumentSet& set = liveDocumentSet();
     fprintf(stderr, "There are %u documents currently alive:\n", set.size());
     for (Document* document : set)
         fprintf(stderr, "- Document %p URL: %s\n", document, document->url().getString().utf8().data());
 }
 #endif